nixos-rebuild-ng: add NIX_SUDOOPTS for remote

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py

@@ -150,11 +150,18 @@ def run_wrapper(
             remote_run_args = _prefix_env_cmd_remote(run_args, normalized_env)
 
         if sudo:
+            sudo_args = shlex.split(os.getenv("NIX_SUDOOPTS", ""))
             if remote.sudo_password:
-                remote_run_args = ["sudo", "--prompt=", "--stdin", *remote_run_args]
+                remote_run_args = [
+                    "sudo",
+                    "--prompt=",
+                    "--stdin",
+                    *sudo_args,
+                    *remote_run_args,
+                ]
                 process_input = remote.sudo_password + "\n"
             else:
-                remote_run_args = ["sudo", *remote_run_args]
+                remote_run_args = ["sudo", *sudo_args, *remote_run_args]
 
         ssh_args: list[Arg] = [
             "ssh",

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py

@@ -199,3 +199,36 @@ def test_custom_sudo_args(mock_run: Any) -> None:
         text=True,
         errors="surrogateescape",
     )
+
+    with patch.dict(
+        p.os.environ,
+        {"NIX_SUDOOPTS": "--custom foo --args", "PATH": "/path/to/bin"},
+        clear=True,
+    ):
+        p.run_wrapper(
+            ["test"],
+            check=False,
+            sudo=True,
+            remote=m.Remote("user@localhost", [], None),
+        )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@localhost",
+            "--",
+            "sudo",
+            "--custom",
+            "foo",
+            "--args",
+            "env",
+            "-i",
+            "PATH=${PATH-}",
+            "test",
+        ],
+        check=False,
+        env=None,
+        input=None,
+        text=True,
+        errors="surrogateescape",
+    )